API Token Scope Enforcement Issue in Gitea

CVE-2026-55982

What is CVE-2026-55982?

The OIDC userinfo endpoint in Gitea is susceptible to a significant security issue where it returns identity claims without enforcing the required API token scopes. This flaw may allow unauthorized users to gain access to sensitive identity information, posing potential risks to user privacy and data integrity. It is crucial for users of affected versions to apply the latest updates promptly to mitigate potential exploitation.

References